topic Re: Firepower - BVI with port channel sub interface in Network Security

Firepower - BVI with port channel sub interface

andy-tf-fung — Sun, 10 Nov 2024 00:08:05 GMT

Hi community,

we want to deploy firepower 3105 - version 7.3.1 to bridge two VLAN(119 & 191) on distribution switch and allow two network to communicate with the same subnet as following

we have run the following test with 10.127.190.11 and 10.127.190.42 ping each other:
1. [success]
a. 10.127.190.11 connected to FTD 1/1 directly
b. 10.127.190.42 connected to FTD 1/2 directly
c. FTD 1/1 & 1/2 run BVI
2. [fail]
a. 10.127.190.11 connected to switchport with access port to vlan 191
b. 10.127.190.42 connected to switchport with access port to vlan 119
c. FTD 1/1 connected to switchport with access port to vlan 191
d. FTD 1/2 connected to switchport with access port to vlan 119
e. FTD 1/1 & 1/2 run BVI
3. [fail]
a. 10.127.190.11 connected to switchport with access port to vlan 191
b. 10.127.190.42 connected to switchport with access port to vlan 119
c. switch and FTD connected with port channel
d. switch port channel trunk vlan 191 & 119
e. FTD 1/1 & 1/2 run port channel
f. FTD port channel have sub interface 191 & 119
g. FTD port-channel.119 and port-channel.191 run BVI

Port channel

Sub interface 119

Sub interface 191

BVI

Re: Firepower - BVI with port channel sub interface

MHM Cisco World — Sun, 10 Nov 2024 13:03:51 GMT

you use FW HA or standalone FW?

MHM

Re: Firepower - BVI with port channel sub interface

balaji.bandi — Sun, 10 Nov 2024 16:43:21 GMT

Are you using FDM or FMC, and what mode that FTD running, check the Limitation and see if the feasible :

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/730/management-center-device-config-73/device-ops-tfw.html?bookSearch=true

Re: Firepower - BVI with port channel sub interface

andy-tf-fung — Mon, 11 Nov 2024 07:21:35 GMT

we are using FMC and the FTD is running in transparent mode, and the FW is in HA

Re: Firepower - BVI with port channel sub interface

balaji.bandi — Mon, 11 Nov 2024 07:47:33 GMT

from command level can you post below information :

show port-channel summary

show interface ip brief

show interface Port-channel1 detail

Re: Firepower - BVI with port channel sub interface

andy-tf-fung — Mon, 11 Nov 2024 09:20:12 GMT

Hi all,

Thanks a lot for your help, may be I simplify the design since my issue is more on the bridging two different vlans with the same IP subnet.

Interface

BVI